conda env update fails when notices are enabled and the base environment's python is being updated

[travishathaway]

Checklist

• I added a descriptive title
• I searched open reports and couldn't find a duplicate

What happened?

This was first reported in this mamba issue:

• mamba env update failing at very end with certifi SSL issue mamba-org/mamba#1925

The bug appears when updating conda's (or mamba's) root/base environment's Python version. We have been able to successfully recreate this in linux Docker containers.

How to recreate

Using this Dockerfile (or whatever other Dockerfile that has the latest conda installed)

FROM --platform=linux/amd64 debian:stable-slim

RUN apt update -y && apt upgrade -y
RUN apt install curl -y
RUN cd /tmp/ && curl -O https://repo.anaconda.com/miniconda/Miniconda3-latest-Linux-x86_64.sh
RUN bash /tmp/Miniconda3-latest-Linux-x86_64.sh -p /opt/conda -b
RUN /opt/conda/bin/conda init --all
RUN /opt/conda/bin/conda install -y -c defaults python conda-build

Build and run this docker image...

Once on the command line:

$ python --version  # let's see which python version we have
Python 3.7.13
$ echo "name: base
channels:
  - defaults
dependencies:
  - python=3.10" > /tmp/environment.yml  # create an environment.yml file with a newer version of Python
$ conda env update -f /tmp/environment.yml
💥  # same error pops up

The following command will also trigger this error (do this instead of running conda env update)

$ conda install python=3.10

How to fix

We should look at how CondaSession and the requests library handles loading TLS root certificates. There's a chance we may be able to load these ahead of time in memory to avoid these situations.

Experimentation for a better solution is encouraged as well.